Part 2 consented-recipient use authority

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.33(a)(1) permits a Part 2 program to use and disclose records in accordance with consent meeting section 2.31 to any person or category of persons identified or generally designated in that consent. Disclosures to central registries and disclosures connected with criminal-justice referrals must also satisfy sections 2.34 and 2.35. The signed scope and any special route remain release gates.

Match the disclosure to the signed scope

Current 42 CFR 2.33(a)(1) depends on consent consistent with § 2.31. Verify the patient, authorized discloser, information, recipient designation, purpose, expiration, revocation state, signature authority, and date. A valid form for one disclosure does not establish a different recipient or purpose.

Route special recipients separately

Central-registry and multiple-enrollment disclosures must meet § 2.34. Criminal-justice referral disclosures must meet § 2.35. Mark those paths before release so a broad recipient label does not bypass their additional conditions.

Preserve the release decision

The consent elements in 42 CFR 2.31 are source evidence. Keep the signed version, request, recipient resolution, data selection, purpose, approval, transmission, accompanying material, correction, and revocation handling in one auditable chain.

Validate the source consent

Confirm the patient's identity, the authorized discloser, a specific and meaningful description of the information, the recipient person or class, purpose, revocation instructions, expiration, signature, date, and any representative authority required by 42 CFR 2.31. Preserve the exact signed version, presentation method, amendments, revocation state, and evidence of authority.

Do not infer a broader consent from a general privacy notice, intake signature, portal setting, referral, payer relationship, or prior release. Resolve unclear designations before selecting records.

Resolve the actual recipient

Match the person or category written in the consent to the destination that will receive or use the information. Record legal and operating name, role, organization, address or endpoint, authentication, category analysis, and any intermediary. A technically valid route can still reach an entity outside the patient's designation.

For a category, create approved criteria and evidence. Do not let a vendor directory, network flag, or user role silently expand the class.

Match information and purpose

Select only records that fit the consent's meaningful description and use them only for its stated purpose. Trace structured fields, notes, attachments, images, metadata, exports, message text, and audit copies. Review defaults and linked objects that may add content beyond the visible selection.

Keep a record-level or field-level manifest for the release. If the recipient requests more, return to the consent and authority analysis rather than treating the first valid disclosure as continuing permission.

Apply special route controls

Identify central-registry and multiple-enrollment activity early and apply section 2.34's event, consent, recipient, distance, payload, and purpose rules. Identify criminal-justice referral activity and apply section 2.35. A broad category in an otherwise valid consent does not replace those conditions.

Screen for other Part 2, HIPAA, state, professional, contractual, and court-process restrictions. Document which rule supports the decision and which qualified roles reviewed uncertainty.

Govern release and correction

Link consent, request, recipient resolution, selected information, purpose, approvals, secure route, actual payload, timestamp, acknowledgment, downstream notice where required, and disclosure log. Use holds for missing or conflicting evidence and restrict overrides.

If information reaches the wrong recipient or exceeds consent, contain it, preserve evidence, seek return or deletion where appropriate, assess reporting and notification duties, correct the routing or selection defect, and verify remediation. Audit denied and abandoned requests as well as completed releases.

Review recurring recipient categories against real destinations at least periodically. Retire categories that have become ambiguous, and update future consent language through the governed form process rather than changing how staff interpret old signed records.

Example

Seventeen proposed releases reach review. Fourteen match a current consent's recipient, information, purpose, and dates; two name a different category and one belongs to the central-registry route. Consent-scope readiness is 14 of 17 releases.

Consented-recipient checklist

• validate every section 2.31 element, authority, expiration, and revocation state;
• resolve the actual recipient against the named person or defined category;
• match each record and field to the signed description and purpose;
• route central-registry and criminal-justice disclosures through special controls;
• preserve selection, approval, transmission, acknowledgment, and notice evidence; and
• audit holds, denials, misroutes, excess data, corrections, and overrides.

Consent is a bounded instruction. Each release must reproduce the match among patient, recipient, information, purpose, and current authority.